CVE-2026-49434: Apache ActiveMQ RCE Vulnerability

CVE-2026-49434 Overview

CVE-2026-49434 is an improper input validation vulnerability [CWE-20] affecting Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. The flaw allows an attacker with the ability to publish or modify entries in a Lightweight Directory Access Protocol (LDAP) server that match the broker's configured searchBase and searchFilter to instantiate denied transports inside the broker Java Virtual Machine (JVM). This behavior enables retrieval of an attacker-controlled URL and the spawning of a second BrokerService within the same JVM. The issue affects versions before 5.19.8 and versions from 6.0.0 before 6.2.7.

Critical Impact
An attacker with LDAP write access can force the broker JVM to instantiate denied transports, fetch attacker URLs, and spawn a rogue BrokerService, compromising broker integrity.

Affected Products

Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7
Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7
Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7

Discovery Timeline

2026-06-30 - CVE-2026-49434 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-49434

Vulnerability Analysis

Apache ActiveMQ supports configuration via LDAP for various broker properties, including transport connectors. The broker resolves entries from LDAP based on a configured searchBase and searchFilter. The vulnerable code path does not enforce the broker's transport allowlist when instantiating transports sourced from LDAP entries. An attacker who can write or modify matching LDAP entries can inject transport definitions that would normally be denied by the broker's configuration.

When the broker processes these entries, it instantiates the transports inside its own JVM. This creates two follow-on effects. First, the JVM fetches attacker-supplied URLs during transport initialization. Second, a second BrokerService instance can be spawned inside the same JVM, altering the runtime broker topology without administrator consent.

Root Cause

The root cause is improper input validation of LDAP-supplied configuration data. The broker trusts LDAP entries matching its search parameters as authoritative input for transport instantiation. It does not re-apply the transport denylist or allowlist checks that protect statically configured connectors. Values retrieved from directory results flow directly into transport factory construction paths.

Attack Vector

Exploitation requires write access to LDAP entries that satisfy the broker's configured searchBase and searchFilter. The attacker inserts or modifies an entry to reference a denied transport scheme and an attacker-controlled URL. When the broker reads the entry, it instantiates the transport, triggers an outbound fetch to the attacker URL, and can be coerced into creating an additional BrokerService in the same JVM. No authentication to the broker itself is required, provided the attacker controls the referenced LDAP data.

Refer to the Apache Mailing List Thread and the Openwall Security Discussion for the vendor's technical description.

Detection Methods for CVE-2026-49434

Indicators of Compromise

Unexpected outbound network connections initiated by the ActiveMQ broker JVM to unknown or external hosts.
Broker logs showing instantiation of transport schemes that should be blocked by the configured denylist.
Presence of more than one active BrokerService instance running inside a single ActiveMQ JVM.
Recent modifications to LDAP entries matching the broker's searchBase and searchFilter.

Detection Strategies

Audit LDAP change logs for writes to entries within the configured searchBase scope, especially those introducing transport URI values.
Correlate ActiveMQ startup and reconfiguration events with outbound HTTP or custom-transport connections from the broker host.
Inspect JVM runtime state or JMX metrics for the count of BrokerService instances registered.

Monitoring Recommendations

Enable verbose logging of transport factory invocations and broker configuration reloads.
Forward ActiveMQ and LDAP audit logs to a centralized SIEM for correlation across systems.
Baseline egress traffic from ActiveMQ hosts and alert on deviations to non-approved destinations.

How to Mitigate CVE-2026-49434

Immediate Actions Required

Upgrade Apache ActiveMQ to version 6.2.7 for the 6.x branch or 5.19.8 for the 5.x branch.
Restrict LDAP write permissions on entries within the broker's searchBase to trusted administrators only.
Review current broker configuration for LDAP-backed properties and validate all resolved values.

Patch Information

Apache has released Apache ActiveMQ versions 5.19.8 and 6.2.7 to remediate CVE-2026-49434. These releases enforce transport validation against configuration sourced from LDAP. Users on any affected version should upgrade directly to a fixed release. Consult the Apache Mailing List Thread for release notes and download links.

Workarounds

Tighten LDAP access control lists so that only trusted identities can create or modify entries matching the broker's searchBase and searchFilter.
Narrow the searchFilter to reduce the set of LDAP entries the broker will consume.
Segment the broker host network to block outbound connections to untrusted destinations until patching is complete.

bash

# Configuration example - verify installed ActiveMQ version and plan upgrade
${ACTIVEMQ_HOME}/bin/activemq --version
# Fixed versions: 5.19.8 or 6.2.7